Health Law

The Henry Ford Health System Makes Another Appearance in the Parade of PHI Security Breaches

Posted on March 16, 2011
The requirements under the HIPAA/HITECH statutes and regulations for public disclosure of breaches of Protected Health Information ('PHI') have brought to light an increasing volume of breaches of PHI involving highly respected and sophisticated providers and insurers...

The NEW Largest Marcher in the Parade of Reported PHI Security Breaches: Health Net, Inc.

Posted on March 16, 2011
By: Elizabeth Litten and Michael Kline This blog series has been following the continuing flow of large security breaches of Protected Health Information ('PHI') and how affected providers and insurers have been responding to their discovery. As reported in a recent posting, prior to yesterday, the New York City Health and Hospitals Corporation's North Bronx Healthcare Network was perhaps the largest marcher in the parade of large PHI security breaches with a reported 1,700,000 persons potentially affected...

AMA, 28 Other Medical Groups Raise Concerns On Stage 2 Meaningful Use Proposals

Posted on March 02, 2011
In a detailed, 46-page letter dated February 25, 2011, the American Medical Association and 28 other medical societies raised serious concerns about the proposed set of requirements for Stage 2 of the Medicare/Medicaid Electronic Health Record (EHR) meaningful use incentive programs...

AMA, 38 Other Medical Groups Raise Concerns On Stage 2 Meaningful Use Proposals

Posted on March 02, 2011
In a detailed, 46-page letter dated February 25, 2011, the American Medical Association and 38 other medical societies raised serious concerns about the proposed set of requirements for Stage 2 of the Medicare/Medicaid Electronic Health Record (EHR) meaningful use incentive programs...

To access this complete feed in the blog feed reader login or register for free.

New Turn in the Parade of PHI Breaches: Office of Civil Rights Exacts Heavy Payments From Cignet Health and Massachusetts General Hospital

Posted on February 28, 2011
As reported previously on this blog series, the requirements under the HIPAA/HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ('PHI') have been bringing direct intervention by attorneys general with respect to enforcement actions regarding such breaches...

The Largest Marcher in the Parade of Reported PHI Security Breaches: NYC Health and Hospitals Corporation's North Bronx Healthcare Network

Posted on February 22, 2011
This blog series has been following the continuing flow of large security breaches of Protected Health Information ('PHI') and how affected providers and insurers have been responding to their discovery. The New York City Health and Hospitals Corporation's North Bronx Healthcare Network ('HHC') has recently become perhaps the largest marcher in the parade of PHI security breaches with a reported 1,700,000 persons affected...

The Parade of PHI Security Breaches: Escalating Enforcement Activity by State Attorneys General - Most Recently in Vermont

Posted on January 27, 2011
 As reported previously on this blog series, the requirements under the HIPAA/HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ("PHI") have been bringing to light new breaches of PHI security and direct intervention by state attorneys general with respect to such breaches...

A Reader's Comment on the Two Large PHI Security Breaches at The University of Rochester Medical Center in 2010

Posted on January 25, 2011
This blog series has been following the continuing flow of large security breaches of Protected Health Information ('PHI') and how affected providers and insurers have been responding to their discovery. On January 19, 2011, a blog posting was made regarding two large PHI security breaches at The University of Rochester Medical Center ('URMC' or the 'medical center') in 2010 (the '2010 Breaches')...

Large PHI Security Breaches: The University of Rochester Medical Center Hits a Double in 2010

Posted on January 19, 2011
This blog series  has been following the continuing flow of large security breaches of Protected Health Information ('PHI') and how affected providers and insurers have been responding to their discovery. The University of Rochester Medical Center ('URMC' or the 'Medical Center') joined in the parade of large PHI security breaches two times in 2010...

HITECH EMR Incentive Registration Opens January 3, 2011

Posted on December 22, 2010
  Early EHR adopters, mark your calendars:  CMS will begin accepting registration for participation in the Medicare EHR incentive program beginning January 3,  2010.   CMS will post a link to the registration process on its Registration and Attestation page on January 3...

PHI: The University of Tennessee Medical Center Joins the Parade of Potential Security Breaches

Posted on December 12, 2010
  This blog has been following the continuing flow of security breaches of Protected Health Information ("PHI") and how affected providers and insurers have been responding to their discovery. The University of Tennessee Medical Center ("UTMC" or the "hospital") based in Knoxville has apparently joined in the march...

Congress Exempts Physicians From Red Flag Rules

Posted on December 08, 2010
Physicians will no longer be defined as "creditors" under the controversial "Red Flag Rules," when clarifying provisions are signed into law as expected.  The House of Representatives has unanimously passed S...

Updated - President Signs Act Exempting Physicians From Red Flag Rules

Posted on December 08, 2010
Update: President Obama signed S. 3987 as Public Law No: 111-319 [Text, PDF] on December 18, 2010. * * * Physicians will no longer be defined as "creditors" under the controversial "Red Flag Rules," when clarifying provisions are signed into law as expected...

PHI: What Can a Provider Do to "Insure" Against a Security Breach?

Posted on December 01, 2010
My colleague, Michael Kline, has been regularly reporting on this blog about the parade of Protected Health Information (PHI) privacy and security breaches that are occurring at large, sophisticated hospital systems, such as the Henry Ford Health System in Michigan, and health insurance carriers, such as Wellpoint, Inc...

PHI: Postscript to the Security Breach at Henry Ford Health System

Posted on November 24, 2010
This blog has been following how requirements under the HIPAA/HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ('PHI') have brought to light a continuing flow of breaches of PHI involving highly respected and sophisticated providers and insurers...

PHI: The Parade of Security Breaches Continues to Lengthen with the Addition of Henry Ford Health System

Posted on November 21, 2010
This blog has been following how requirements under the HIPAA/HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ('PHI') have brought to light a continuing flow of breaches of PHI involving highly respected and sophisticated providers and insurers...

The Parade of PHI Security Breaches: Escalating Enforcement Activity by Attorneys General - Most Recently in Indiana

Posted on November 02, 2010
As reported previously on this blog, the requirements under the HIPAA/HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ('PHI') have been bringing to light new breaches of PHI security and direct intervention by attorneys general with respect to such breaches...

Missing from the Parade of Large PHI Security Breaches - Advice to the Public by the Secretary of HHS on its Change in an HHS Website URL

Posted on October 25, 2010
Note: The title and substance of this blog entry has been substantially amended in response to a helpful comment by an anonymous fellow blogger. I am grateful that others are reading our blog posts and have sufficient interest in the topic to comment...

Missing from The Parade of Large PHI Security Breaches - Reasonably Prompt Posting by the Secretary of HHS on the HHS Website

Posted on October 22, 2010
As reported previously on this blog, the requirements under the HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ('PHI') have continuously been bringing to light new breaches of PHI involving highly respected and sophisticated providers and insurers...

Missing from the Parade of Large PHI Security Breaches - Advice to the Public by the Secretary of HHS on its Move of an HHS Website Address

Posted on October 22, 2010
Note: The title and substance of this blog entry has been substantially amended in response to a helpful comment by an anonymous fellow blogger. I am grateful that others are reading our blog posts and have sufficient interest in the topic to comment...

"PHI Warnings" in Communications -- A Potential Source of Unintended Security Breach?

Posted on September 24, 2010
By Elizabeth Litten and Michael Kline Many Covered Entities (CE) and Business Associates (BA) (and now, Subcontractors (SC) as well) are using a variety of approaches to limit exposure to liability and the potentially dire consequences associated with security breaches of Protected Health Information ('PHI')...

"We're going to have to ride our bike and fix it at the same time."

Posted on September 17, 2010
The virtual "ink" is barely dry on the July 13, 2010 final rule on Stage 1 Meaningful Use criteria, but the federally chartered Health IT Policy Committee is already beginning to talk about Stage 2.   Modern Healthcare reports in a Sptember 17 article (registration required) that the advisory body met this week to review a schedule for implementing standards that will apply to eligibility for federal funding for users of electronic health records during fiscal years 2012-2013...

The Parade of PHI Security Breaches - Providers and Insurers Beware of Attorney General Richard Blumenthal and Other Attorneys General

Posted on September 05, 2010
As reported previously on this blog, the requirements under the HIPAA/HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ('PHI') have continuously been bringing to light new breaches of PHI involving highly respected and sophisticated providers and insurers...

CMS Answers Frequently Asked Questions Regarding Electronic Health Record Incentives

Posted on August 27, 2010
by Todd Rodriguez, Esquire In July, the Centers for Medicare and Medicaid Services (CMS) released the much-anticipated final regulations that providers are required to meet in order to receive the Medicare incentives for adoption of a certified electronic health record system...

The Ever-Lengthening Parade of PHI Security Breaches - The New Paper Chase of Four Massachusetts Community Hospitals

Posted on August 15, 2010
    This blog has been reporting on the effects on providers, insurers and others of the HIPAA/HITECH statutes and regulations that require public disclosure of breaches of unsecured Protected Health Information ("PHI"). While the greatest attention under HIPAA/HITECH has been on electronic health records ("EHR"), the increasing inventory of billions of hard copy pages of paper health records containing PHI ("Paper HR") is a continuing material hazard for providers and insurers and their respective business associates and subcontractors...

Charity Care Matters for Hospital EHR Incentive Payments

Posted on July 30, 2010
The recently published final "meaningful use" regulations make it clear that hospitals must be careful in how they report charity care on their Medicare cost reports if they want to maximize their incentive payments for using EHR. The amount a hospital receives in EHR incentive payments is calculated based on the hospital's Medicare and Medicaid patient volume, calculated as a fraction of the hospital's total patient volume...

PHI: The Parade of Security Breaches Continues to Lengthen with the Addition of Thomas Jefferson University Hospital

Posted on July 30, 2010
  The requirements under the HIPAA/HITECH statutes and regulations for public disclosure of security breaches of Protected Health Information ('PHI') have brought to light an increasing volume involving highly respected and sophisticated providers and insurers...

Rite Aid settles HIPAA Claims for $1 Million

Posted on July 27, 2010
In a press release dated July 27, 2010, the Department of Health and Human Services announced a settlment under which Rite Aid Corporation and its affiliates have agreed to pay $1 million to settle potential HIPAA violations.   The pharmacy chain also entered into a consent order with the Federal Trade Commission...

Meaningful Use At A Glance

Posted on July 15, 2010
The following is a chart summarizing the 15 "core" objectives which must be met, the menu from which 5 additional objectives must be selected, and the standards by which achievement of these objectives will be measured in order to qualify for EHR funding under the HITECH Act based on the final rules published on July 13, 2010:   OBJECTIVE MEASURE Core set: Record patient demographics (sex, race, ethnicity, date of birth, preferred language, and in the case of hospitals, date and preliminary cause of death in the event of mortality) More than 50% of patients' demographic data recorded as structured data Record vital signs and chart changes (height, weight, blood pressure, body-mass index, growth charts for children) More than 50% of patients 2 years of age or older have height, weight, and blood pressure recorded as structured data Maintain up-to-date problem list of current and active diagnoses More than 80% of patients have at least one entry recorded as structured data Maintain active medication list More than 80% of patients have at least one entry recorded as structured data Maintain active medication allergy More than 80% of patients have at least one entry recorded as structured data Record smoking status for patients 13 years of age or older More than 50% of patients 13 years of age or older have smoking status recorded as structured data For individual professionals, provide patients with clinical summaries for each office visit; for hospitals, provide an electronic copy of hospital discharge instructions on request Clinical summaries provided to patients for more than 50% of all office visits within 3 business days; more than 50% of all patients who are discharged from the inpatient department or emergency department of an eligible hospital or critical access hospital and who request an electronic copy of their discharge instructions are provided with it On request, provide patients with an electronic copy of their health information (including diagnostic test results, problem list, medication lists, medication allergies, and for hospitals, discharge summary and procedures) More than 50% of requesting patients receive electronic copy within 3 business days Generate and transmit permissible prescriptions electronically (does not apply to hospitals) More than 40% are transmitted electronically using certified EHR technology Computer provider order entry (CPOE) for medication orders More than 30% of patients with at least one medication in their medication list have at least one medication ordered through CPOE Implement drug–drug and drug–allergy interaction checks Functionality is enabled for these checks for the entire reporting period Implement capability to electronically exchange key clinical information among providers and patient-authorized entities Perform at least one test of EHR's capacity to electronically exchange information Implement one clinical decision support rule and ability to track compliance with the rule One clinical decision support rule implemented Implement systems to protect privacy and security of patient data in the EHR Conduct or review a security risk analysis, implement security updates as necessary, and correct identified security deficiencies Report clinical quality measures to CMS or states For 2011, provide aggregate numerator and denominator through attestation; for 2012, electronically submit measures   Menu Set (implement 5 out of 10) Implement drug formulary checks Drug formulary check system is implemented and has access to at least one internal or external drug formulary for the entire reporting period Incorporate clinical laboratory test results into EHRs as structured data More than 40% of clinical laboratory test results whose results are in positive/negative or numerical format are incorporated into EHRs as structured data Generate lists of patients by specific conditions to use for quality improvement, reduction of disparities, research, or outreach Generate at least one listing of patients with a specific condition Use EHR technology to identify patient-specific education resources and provide those to the patient as appropriate More than 10% of patients are provided patient-specific education resources Perform medication reconciliation between care settings Medication reconciliation is performed for more than 50% of transitions of care Provide summary of care record for patients referred or transitioned to another provider or setting Summary of care record is provided for more than 50% of patient transitions or referrals Submit electronic immunization data to immunization registries or immunization information systems Perform at least one test of data submission and follow-up submission (where registries can accept electronic submissions) Submit electronic syndromic surveillance data to public health agencies Perform at least one test of data submission and follow-up submission (where public health agencies can accept electronic data)   Additional choices for hospitals and critical access hospitals: Record advance directives for patients 65 years of age or older More than 50% of patients 65 years of age or older have an indication of an advance directive status recorded Submit of electronic data on reportable laboratory results to public health agencies Perform at least one test of data submission and follow-up submission (where public health agencies can accept electronic data)   Additional choices for eligible professionals: Send reminders to patients (per patient preference) for preventive and follow-up care More than 20% or patients 65 years of age or older or 5 years of age or younger are sent appropriate reminders Provide patients with timely electronic access to their health information (including laboratory results, problem list, medication lists, medication allergies) More than 10% of patients are provided electronic access to information within 4 days of its being updated in the EHR Source: New England Journal of Medicine http://healthcarereform...

Final "Meaningful Use" Criteria for EHR Subsidies Released

Posted on July 14, 2010
On July 13, 2010, the Department of Health and Human Services released a pair of final regulations (one from CMS, one from the Office of National Coordinator for HIT ) detailing the 'meaningful use' criteria which will determine whether users of electronic health records will qualify for the government subsidies under the HITECH Act during the first two years of the program (2011-2012)...

Bloggers, promote your law blog by nominating your blog for inclusion in USLaw.com's Law Blog Directory and RSS Reader. Benefits described.